Practical attacks against 4G (LTE) access network protocols
secure-systems-aalto.blogspot.com
secure-systems-aalto.blogspot.com
1) LTE uses broadcast messages to do push notifications. These are unencrypted and unauthenticated. Researchers can trigger them silently by spamming you on Facebook, and triangulate your location since the LTE network only sends the pages to the geographic location you are in.
2) LTE supports crash reports that can potentially include your GPS coords. A rouge base station can request these from your phone without setting up an encrypted channel due to shitty baseband implementations.
3) something about denial of service
the excellent paper is here: http://arxiv.org/pdf/1510.07563v1.pdf
1) This is really a fundamental limitation of all encryption: It hides what you are sending, but not the fact that you are sending something. Paging in mobile networks is a broadcast message that basically just says "Device with ID XXXX, please wake up and check in with the network". If you can cause pages (by calling, texting or with Facebook messages) then you can see in what area the pageing is sent, and you can find out the ID (TMSI) of the device.
2) It is not a crash report, but a connection failure report.
3) During the initial connection, before encryption is started, an rogue transmitter can send a connection rejection message to the phone, pretending to be the network. The phone will not try 4G/3G again and downgrade to 2G. The attacker can then break the weak 2G authentication and make the phone believe that it is a real base station. The last part is what an IMSI catcher / Stingray device does.
Pretty cool.
I wonder how much of "some assembly required" there is to get this kind of experiment up and running.
http://www.zdnet.com/article/at-t-t-mobile-verizon-vulnerabl...
I always avoid wifi thinking cell data is safer but apparently not at all.
Sometimes I wish phones/tablets had ethernet ports.
People will not be easily breaking WPA2, if you rotate your keys, and implement other security measures such as RAPD or .x1 your threat agents change from anyone with a cellphone to very well funded and "armed" adversaries.
WPA2 Enterprise uses AES for per-client session key generation, and -when you use EAP-TLS or EAP-TTLS- TLS for transportation of client credentials and assurance that both ends of the conversation are who they say they are. [0]
You can make WiFi just as secure as wired Ethernet, it just takes a -surprisingly small- bit of work. :)
If Windows and Mac machines supported EAP-PWD, or (even better) WFA-TLS-UNAUTH [1] even coffeeshop WiFi would be secure from passive attack.
[0] When you use WiFi client and RADIUS server certs, rather than just username and password.
[1] EAP offers a very large array of authentication methods. EAP-PWD authenticates with just a username and password and doesn't muck about with TLS certs. WFA-TLS-UNAUTH uses TLS, but doesn't verify the RADIUS server cert and doesn't require a client cert. Both of these schemes offer substantially less assurance than full-blown EAP-[T]TLS, but they also let you offer encrypted WiFi without hassle.